Talos Year in Review - Key Insights for 2025 Explained

What Happened

In the latest edition of the Threat Source newsletter, Talos has released its 2025 Year in Review report, summarizing significant cybersecurity trends and findings from the past year. The report emphasizes the importance of collaboration among teams, drawing parallels to the themes found in the book and upcoming movie adaptation of Project Hail Mary. Just like the characters in the story who must work together to save their worlds, Talos teams collaborated to transform raw data into actionable intelligence for the community.

The report reveals that React2Shell was the most targeted CVE in 2025, despite being discovered only in December. Additionally, the findings indicate that a significant portion of vulnerabilities affects widely used frameworks, highlighting the risk of supply chain attacks. This year’s insights are crucial for organizations looking to bolster their defenses against evolving threats.

Who's Affected

The findings in the Talos Year in Review impact a wide range of organizations, especially those relying on identity and access management (IAM) systems. Nearly a third of MFA spray attacks targeted IAM applications, indicating that attackers are increasingly focusing on identity-centric vulnerabilities. This trend underscores the necessity for businesses to prioritize security measures around identity management and network components.

With the rise of sophisticated cyber threats, understanding these trends is essential for organizations aiming to protect their assets and maintain operational integrity. The report serves as a wake-up call for many, highlighting the urgent need for improved security protocols and awareness across various sectors.

What Data Was Exposed

The report details several alarming statistics that reveal the landscape of cybersecurity threats in 2025. Phishing remained a prevalent method for initial access, observed in 40% of Talos Incident Response cases. Furthermore, Qilin emerged as the most frequently seen ransomware variant, affecting over 40 victims each month, excluding January. These insights highlight the ongoing risks organizations face and the necessity of proactive measures.

Additionally, the report notes that 25% of vulnerabilities in the top 100 list affect widely used frameworks and libraries. This statistic emphasizes the potential for supply chain-style attacks, where vulnerabilities in common tools can lead to widespread exploitation across multiple organizations.

What You Should Do

Organizations should take immediate action based on the insights from the Year in Review. First, they need to prioritize patching vulnerabilities in network devices, especially those acting as identity control points. This includes Application Delivery Controllers (ADCs) and other critical components that manage access to sensitive resources.

Defenders should also focus on high-leverage vulnerability classes that enable identity compromise and policy manipulation. By understanding the tactics employed by attackers, organizations can better fortify their defenses and ensure that they are not easy targets for cybercriminals. The Talos Year in Review serves as a critical resource for anyone looking to navigate the complex threat landscape effectively.